aspsecuritykit.net

What It Is

ASPSecurityKit (ASK) is a zero-trust identity and access management component for multi-tenant .NET websites and APIs. It is not just a login library; instead, it combines authentication, MFA, IP firewalling, XSS protection, user verification, activity-data authorization (ADA), and account suspension mechanisms into a security pipeline that is enabled by default. It supports ASP.NET Core MVC/Web API, ASP.NET MVC/Web API, and ServiceStack.

Core Capabilities

Its protection focuses on identity and access control. HMAC authentication includes the URL, HTTP method, request body, timestamp, and nonce in the signature input to help prevent request tampering and replay attacks. Service HMAC is designed for third-party callbacks, AuthCookie for MVC sessions, and Service Key for capability-limited third-party integrations. ADA is one of its more distinctive features: it can authorize access based on actions and sensitive data fields in the request, making it suitable for complex permission models such as multi-tenant SaaS, finance, and marketplaces. IP Firewall can be bound to user sessions or API Keys; MFA supports session-level verification, as well as exemptions by operation or network allowlist. The source packages also include implementations for account management, user management, email verification, 2FA, event notifications, and an admin backend.

Pricing and Deployment

The main content does not disclose clear pricing or licensing details. It only mentions a NuGet Library and Source Packages, with separate trial source package and premium source package options. In terms of deployment, it is more like a development framework/component that needs to be integrated into an existing .NET project, while allowing customization of data access and entity models such as Repository, User, and Permit.

Pros and Cons

The main advantage is that it covers common .NET web security infrastructure. Its default zero-trust, explicit opt-out design helps reduce the risk of misconfiguration. The source packages can save development time for account and permission modules, and there are references to use by financial platforms and penetration testing reports. The downsides are its clear ecosystem boundaries, with limited value for non-.NET projects; unclear pricing, compliance certifications, SLA, and Chinese-language support; and MFA channels such as SMS/TOTP still appear to be described in “on-demand/future” terms in the text.

Who It’s For and Access from China

It is best suited to teams with .NET capabilities that need to build their own IAM/permission systems, such as SaaS products, financial APIs, developer portals, and marketplace platforms. There is no clear information on access from mainland China or supported payment methods, so both are considered unknown. If you need a more controllable domestic-friendly alternative, consider ASP.NET Core Identity, Keycloak, Casdoor, or commercial IAM options such as Auth0, Okta, and Microsoft Entra ID.